Bug #4729
closed
TransformerFactory doesn't accept ACCESS_EXTERNAL_STYLESHEET property
100%
Description
In the codebase I have exisiting code like this (boiled down to the essence)
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Transformer transformer = transformerFactory.newTransformer();
//set transformer properties...
StringReader stringReader = new StringReader(someXml);
transformer.transform(new StreamSource(stringReader), someOutput);
When I include Saxon as a library to use it at some other place in my code, the above code breaks. It raises a java.lang.IllegalArgumentException: Unrecognized configuration feature: http://javax.xml.XMLConstants/property/accessExternalDTD
I saw there was a discussion in https://saxonica.plan.io/issues/4234 about this but it seem to be not solved. I tried with Saxon-HE 10.2 and 9.9.1-7. Both have the exception.
If I remove ACCESS_EXTERNAL_DTD/ACCESS_EXTERNAL_STYLESHEET it works. But then the code really tries to access an external dtd!
I think you should support the above properties as you wrote in https://saxonica.plan.io/issues/4234: "However, when input is provided in the form of a StreamSource, and we instantiate the XMLReader ourselves from within Saxon, then we should arguably take account of these properties supplied to the TransformerFactory by setting corresponding properties on the XMLReader that we instantiate. I will look at making that change."
I think this is especially important because Saxon is "registered" to be the factory returned by "TransformerFactory.newInstance()" as soon as it is on the classpath. Of course in my own code I can change this and might use something like TransformerFactory.newDefaultInstance but imagine if a third party library makes use of a transformer via newInstance... Maybe it could also be an option to provide a saxon dependency that includes the Saxon Transformers but does not "register" itself as standard transformer. I don't know if this is easy to achieve as I do not know the details of this mechanism. But if would be possible it would be easier to just use the Saxon Transformer where I want it to be used but rely on the default transformers at other places.
Related issues
Please register to edit this issue
.